SecOps Flashcards
Differential versus incremental backup
Differential: backup everything since last FULL backup
Does not clear the archive bit
Incremental : backup everything since last backup
Clears the archive bits
Copy backup ?
Full backup without archive bit, used before system upgrades or patching
Miroring
Copying data exactly to other disk. Raid 1 for example
Stripping
Using multiple disk to write
If parity, we could retrieve data if we are loosing a disk, with no parity we loosing data but write faster
Raid 0
Stripping without parity
Raid 1
Mirror, 2 disks with identical data
Raid 5
Stripping with distributed parity, need at least 3 disks
Database shadowing
Exact real copy on other location
Electronic Vaulting
E-vaulting
Using a remote backup service, backup are sent off-site electronically at certain interval
Remote journaling
Sends transaction log file to a remote location
Lifecycle of DRP
Mitigation
Preparation
Response
Recovery
Rescue team
Activation/notification
Ecacuate employe
Notify
Pull the cable from infected servers
Shut down system
Recovery team
Failover
Responsible for getting the alternate site running
System rebuilmost critical systems first
Salvage team
Failback
Responsible for returning to primary site
Least critical applications first to be sure it’s stable
Redundant site
Complete identical site to our production
Having staff at it
Hot site
Similar to redundant sote but only critical applications and sys
Lower specs sys often
Manual switch, < 1h
Warm site
Similar to the hot sote but not real time data
Often restore from backup
Switch manually around 4-24h
Cold site
Only having UPS, hvac, isp, generator but no system (need to be acquired)
The cheaper ans longer options can be > weejs
COOP
How we keep operating in a disaster
Staff to alternate sites
What are all the operationnal things we need ?
Cyber Incident Response Plan
Could be part of the DRP or not
Ddos, worms, ransomware, etc
OEP Occupant Emergency Plan
How do we protect our staff, facilities in a disaster event
Focus on safety and evacuation, details how to evacuate, how often do our drills and the training
2 Network forensic form ?
Catch it as you can: all packet passing through a certain traffic captured and then analysis in batch mode
Stop, look and listen: each packet is analyzed and only certain informations is saved for future
MOU/MOA
Memorandum of Understanding/ Agreement
Staff are responsible for certains activities, legal documents
